code wiki / _hdl_build / _gpu_dxg_device_gate.nx
_gpu_dxg_device_gate.nx
buildroot/runtime/_hdl_build/_gpu_dxg_device_gate.nx
about
_gpu_dxg_device_gate.nx -- SOVEREIGN-GPU ladder R3 (create a real WDDM DEVICE on the RTX 5080).
R0 reached the GPU set, R1 IDed the discrete 5080, R2 opened a per-adapter kernel handle from its
LUID. R3 feeds that adapter handle to LX_DXCREATEDEVICE and gets back a real WDDM DEVICE handle --
the object GPU command submission (R4+) hangs off of.
ABI (recon-pinned LIVE on this kernel, _gpu_dxg_r3_recon: the uapi header is absent so the size was
found by sweep -- only _IOC_SIZE=64 is recognized, all others -ENOTTY; the OUT handle's offset was
found by write-back scan):
LX_DXCREATEDEVICE = _IOWR(0x47, 0x02, 64) = 0xC0404702
struct d3dkmt_createdevice (64B): adapter @0 (union d3dkmthandle/u64, IN); flags @8 (u32, IN=0);
device @12 (d3dkmthandle, OUT); rest @16.. reserved (legacy cmd-buf).
NB: device handles live in the per-process DEVICE namespace, numerically independent of the global
ADAPTER namespace -- so a device handle may share a NUMBER with an adapter handle; we never test
device-vs-adapter numeric inequality. We test write-back + per-call distinctness + tamper instead.
GREEN iff (author=organ, from REAL device returns, never $?):
A) enum ret==0 AND num_adapters>=2 AND exactly ONE discrete hw adapter; open(discrete LUID) ret==0;
B) CREATEDEVICE #1 ret==0 AND device1 != 0 AND device1 was WRITTEN into a pre-zeroed slot (offset 12);
C) CREATEDEVICE #2 ret==0 AND device2 != 0 AND device2 != device1
(per-call allocation -> a REAL device object each time, not a stuck constant);
D) TAMPER matrix, each distinct from the real ret==0:
T1 bogus adapter handle (0xdeadbeef), size 64 -> ret!=0 AND device slot stays 0 (no device w/o a real adapter);
T2 wrong _IOC_SIZE (56) -> -ENOTTY (unknown ioctl); T3 CREATEDEVICE on a non-dxg fd -> -ENOTTY.
fd close releases the device + adapter handles (per-fd dxgkrnl cleanup). Marker -> knowledge/status/gpu_dxg.log
(DXGDEVGATE). raw syscalls only (no libvulkan/cuda/dxcore/libc). NO-WAVE: device-create only, ZERO throughput.
license_tier: ORIGINAL
dependencies 1 imports · 0 importers
imports: nx_syscalls.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 30 | const ENUM2_CODE: i64 = 0xC0104714 // LX_DXENUMADAPTERS2 |
| 31 | const QAI_CODE: i64 = 0xC0184709 // LX_DXQUERYADAPTERINFO (ADAPTERTYPE) |
| 32 | const OAFL_CODE: i64 = 0xC00C4701 // LX_DXOPENADAPTERFROMLUID |
| 33 | const CDEV_CODE: i64 = 0xC0404702 // LX_DXCREATEDEVICE (_IOWR(0x47,0x02,64), recon-pinned) |
| 34 | const CDEV_BADSZ: i64 = 0xC0384702 // wrong _IOC_SIZE=56 -> unknown ioctl (-ENOTTY) tamper |
| 35 | const DEV_OFF: i64 = 12 // OUT device-handle offset within the 64B struct |
functions
| 37 | func p(s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(1,s,nn); return 0 } |
| 38 | func fp(fd: i64, s: *u8) -> i64 { var nn: i64=0; while s[nn]!=(0 as u8){nn=nn+1} sys_write(fd,s,nn); return 0 } |
| 39 | func n(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } |
| 40 | func x(v: i64) -> i64 { p("0x" as *u8); let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } var i:i64=0; let o:*u8=sys_mmap(20); while i<k{o[i]=bb[k-1-i];i=i+1} sys_write(1,o,k); return 0 } |
| 41 | func fx(fd: i64, v: i64) -> i64 { let bb:*u8=sys_mmap(20); var k:i64=0; var m:i64=v; if m==0{bb[0]=48;k=1}; while m>0{ let d:i64=m&15; if d<10{bb[k]=(48+d) as u8}else{bb[k]=(87+d) as u8}; m=(m>>4); k=k+1 } let o:*u8=sys_mmap(20); var i:i64=0; while i<k{o[i]=bb[k-1-i];i=i+1} fp(fd,"0x" as *u8); sys_write(fd,o,k); return 0 } |
| 42 | func rd32(buf: *u8, off: i64) -> i64 { return (buf[off] as i64)|((buf[off+1] as i64)<<8)|((buf[off+2] as i64)<<16)|((buf[off+3] as i64)<<24) } |
| 44 | func query_type(fd: i64, handle: i64, qtype: i64, psize: i64, outv: *i64) -> i64 |
| 54 | func open_from_luid(fd: i64, luid_lo: i64, luid_hi: i64, outh: *i64) -> i64 |
| 62 | func create_device(fd: i64, code: i64, adapter: i64, outd: *i64) -> i64 |
| 71 | func main() -> i64 |